Fighting cybercrime across the world
Cyber risk is growing for businesses across the world. Our analysis has shown that 2021 was a record year for vulnerabilities, and our latest Kroll Quarterly Threat Landscape Report found a 356% increase in common vulnerabilities and exposures (CVEs) or zero-day vulnerabilities being exploited for initial access when compared to Q3 2021. In the wake of high-profile vulnerability notifications, this underscores the speed at which cybercriminals can operate.
In Hong Kong, specifically, we’ve seen a huge increase in cybercrime. Data from the Financial Services Development Council shows that cyber incidents rose from 2,206 in 2011 to 12,916 in 2020 (representing an almost six-fold increase). The value of those crimes rose too, from HK$148 million in 2011 to a staggering HK$2.96 billion in 2020.
As cyberattacks continue to hit the headlines and firms suffer the financial penalties of security incidents, concern is growing. Increasingly, we are seeing demand for attack simulations and resilience testing, as well as preventative measures to monitor for suspicious activity that could later result in an incident.
Professional Services Sector at Risk
Our data has shown that the professional services sector continues to be a prime target for cyberattack, accounting for 16% of cyber cases in Q4 2021. Other industries in the top five targeted sectors included technology/telecommunications, healthcare, manufacturing and financial services. For the remaining sectors—education, pharmaceutical, construction, food and agriculture—there was an increase in the number of incidents largely due to ransomware, with the exception of education, where unauthorized access was primarily used to infiltrate systems.
The Most Prevalent Attacks
In terms of the most common sources of infection, phishing ranked highest, accounting for 39% of all suspected initial access methods over the final quarter of 2021. The effectiveness of phishing comes down to its exploitation of people rather than system. It has led to a consistent number of business email compromise attacks, which are then used to deploy malware or to trick users into entering credentials on fake landing pages. Most of these attacks lead to significant financial and operational loss for victims.
Third-party vulnerability (8.9%) and remote code execution (4.5%) featured among the top five infection vectors in Q4 2021. Social engineering also made its debut into the top five, accounting for around 4% of infections.
Another area at risk from adversaries is the supply chain. Smaller suppliers, who generally have a less sophisticated IT infrastructure and security systems in place, are attacked in an attempt to reach a larger company for which they may provide a service.
Building Cyber Resilience
Organizations can improve their resilience to cyberattacks in many ways. Particularly given the rate at which vulnerabilities are being exploited by attackers, a robust vulnerability management plan that prioritizes and coordinates patching updates will be important.
With regards to the extent of successful phishing attacks, it proves why workforce education is so critical and is a reason to assess your business in terms of its phishing resilience. Getting a better picture of how vulnerable a business is will be important from a risk evaluation standpoint.
Beyond this, there are a series of proactive measures that can be taken with penetration tests and red teaming, which aim to find vulnerabilities that threat actors could exploit. Monitoring technology to look for suspicious activity within an IT environment is also critical to stay one step ahead of attackers.
Our analysis of Q4 2021 highlights the rapid evolution of adversaries not only in terms of the actors themselves but also in their exploitation activities. Businesses must use actionable threat intelligence to guide their cyber security strategies, and in the event that attackers do manage to breach an organization’s systems, the incident response process should be clear and well-established to ensure fast validation, containment of the threat and support with post-incident recovery.
-- Contact us at [email protected]
-
Architect turns Papercutter, Linking Old and Modern Mark O'Neill
Visitors to the city should be given the Hong Kong Heritage Map, with more than 300 historical buildings to visit – enough to stay for several weeks! This is the work of Nick Tsao, founder of
-
HK migrants alarmed by new British policy Mark O'Neill
Hong Kong people who emigrated to Britain with a BNO passport are alarmed by the new immigration policy outlined on Monday by Prime Minister Sir Keir Starmer. Most alarming is a new requirement that
-
HK says Goodbye to Pioneer of English Education Mark O'Neill
On May 7, 150 people crowded into St John’s Cathedral in Garden Road to say goodbye to a polymath and pioneer of English-language education who lived in the city for 42 years. Dr Verner Bickley
-
French Sisters in HK saved 34000 abandoned children Mark O'Neill
In 19th century Hong Kong, families abandoned thousands of girls whom they could not or would not bring up. They faced death, disease, a life of domestic service or prostitution. But the Sisters of
-
Czech National Ballet in Hong Kong Arts Festival Kevin Ng
Nowadays Hong Kong seldom plays host to overseas ballet companies, except during the annual Hong Kong Arts Festival. Czech National Ballet is the only ballet company touring this year’s Festival. Its